Atty. Docket No. 600323.021 

Amendments to the Claims: 

This listing of claims will replace all prior versions and listings of claims 
in the application: 

1 . (Currently Amended) A method for providing an improved network 
monitoring system, the network monitoring system comprising an event database for 
storing event data representing events occurring on the network, the event data being 
gathered by a plurality of monitoring devices located at a plurality of different, remote 
locations on the network, the method comprising: 

allowing users to insert one or more triggers into the event database, the 
triggers automatically initiating a programmed response at the detection of an 
oondition event including gathered event data prior to insertion of the gathered event data 
into the event database, the oonditio n event mav^b eis one of a primitive event, a database 
event or a temporal event; 

distributing the event database to a plurality of remote network locations, 
wherein each remote network location stores a local table containing event data generated 
at the remote location and one or more replica tables containing event data generated at 
other remote locations, and wherein a union of the local and replica tables is generated to 
form a combined event database at the remote location; and 

using triggers and local and replica table unions during delivery of event 
data to users of the network monitoring system wherein the local and replica tables 
update one another when the event data of one of said tables changes, 

2. (Original) The method of claim 1, comprising providing a notification 
component for registering similar client requests for event data and substantially 
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contemporaneously delivering requested event data to all clients having similar registered 
requests. 

3. (Currently Amended) An event database for use in a network 
monitoring system, the event database storing event data representing events occurring on 
the network, the event data being gathered by a plurality of monitor devices located at a 
plurality of different, remote locations on the network, the event database comprising: 

an automation engine for processing one or more triggers contained in the 
event database, the triggers automatically initiating a programmed response at the 
detection of an oonditio n event including on gathered event data prior to insertion of the 
gathered event data into the event database, the condition event mav-b eis one of a 
primitive event, a database event or a temporal event; 

a local table stored at each remote network location containing event data 
generated at the remote location; 

one or more replica tables stored at each remote network location 
containing event data generated at other remote locations, wherein a union of the local 
and replica tables is generated to form a combined event database at the remote location, 
and wherein the local and replica tables update one another when the event data of one of 
said tables changes. 

4. (Currently Amended) A method for handling event data from monitored 
sites in a computer network, comprising: 

receiving event data from the sites at a monitoring location; 
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when received at the monitoring location, pre-processing the event data 
before the event data is inserted into an event database to determine if an conditio n event 
is met as set forth in a trigger; 

if the trigger conditio n event is met, initiating an action relating to the 
event data, the action being defined in the trigger, the conditio n event aav^b eis one of a 
primitive event, a database event or a temporal event; 

inserting the event data into the event database thereby producing central 

data; and 

transmitting the central data to each of the monitored sites; 

wherein each of the monitored sites includes locally-generated event data 
and a replica of the central data; 

wherein a union of the locally-generated event data and the central data is 
formed at each of the monitored sites; and 

wherein the monitored sites update one another when the event data of one 
of said monitored sites changes. 

5. (Original) The method of claim 4, wherein pre-processing the event 
data comprises determining whether the event data comprises a duplication of other event 
data in the event database or received at the monitoring location. 

6. (Original) The method of claim 5, wherein initiating the action 
comprises denying storage of the event data in the event database if it comprises a 
duplication of other event data, 

7. (Currently Amended) The method of claim 4, wherein if the event data 
does not meet the conditio n event . it is temporarily stored outside the data store. 
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8. (Currently Amended) The method of claim 4, wherein for event data 
received at the monitoring location, a query is executed, and an condition event is 
evaluated, which, if true, causes the execution of the action. 

9. (Original) The method of claim 8, wherein the action comprises at least 
one of a sequence of Structured Query Language (SQL) statements and an external script. 

10. (Original) The method of claim 4, wherein the trigger has a coupling 
mode that indicates when the action should be executed. 

1 1 . (Original) The method of claim 4, wherein the trigger allows an 
administrator of the network to connect events, conditions and actions. 

12. (Original) The method of claim 4, wherein the event data comprises a 
primitive event. 

13. (Original) The method of claim 4, wherein the event data comprises a 

database event. 

14. (Original) The method of claim 4, wherein the event data comprises a 
temporal event. 

15. (Original) The method of claim 4, wherein the trigger comprises a 
database trigger. 

16. (Original) The method of claim 4, wherein the trigger comprises a 
temporal trigger. 

1 7. (Original) The method of claim 1 6, wherein the temporal trigger 
signals an event at a determined frequency from a specified start time until a specified 
end time. 
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18. (Original) The method of claim 4, wherein initiating an action 
comprises communicating a message in accordance with the event data to at least one 
customer location that has subscribed to receive the event data, and storing the event data 
in a data store at the monitoring location. 

19. (Original) The method of claim 18, wherein the pre-processing occurs, 
at least in part, during a period when the data store is inaccessible. 

20. (Previously Amended) The method of claim 1 8, wherein the message 
communicated in accordance with the event data is included in the union of at least event 
data of a local network and event data of a remote network. 

21 . (Original) The method of claim 20, wherein the union comprises a 
union of event data tables. 

22. (Canceled) 

23. (Previously Presented) The method of claim 4, wherein the monitoring 
locations update one another with their event data. 

24. (Previously Presented) The method of claim 4, wherein at least one 
monitoring location is enabled to take ownership of a replica of remotely-generated event 
data to make modifications thereto without instructions from the remote monitoring 
location associated therewith. 

25. (Previously Presented) A system for handling event data from 
monitored sites in a computer network, comprising: 

means for receiving event data from the sites at a monitoring location; 
means for pre-processing the event data, when received at the monitoring 
location, to determine if a condition is met for setting a trigger; 
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means for communicating a message, if the trigger is set, in accordance 
with the event data to at least one customer location that has subscribed to receive the 
event data, and storing the event data in a data store at the monitoring location, the trigger 
being in response to a primitive event, a database event or a temporal event; 

means for inserting the event data into the event database thereby 
producing central data; and 

means for transmitting the central data to each of the monitored sites; 

wherein each of the monitored sites includes locally-generated event data 
and a replica of the central data; 

wherein a union of the locally-generated event data and the central data is 
formed at each of the monitored sites; and 

wherein the monitored sites update one another when the event data of one 
of said monitored sites changes. 

26. (Cancelled) 
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